DFS-R: Debug Logging Initialization

Microsoft.Windows.FileServer.DFSR.DebugLogInitFailedMonitor (UnitMonitor)

This object monitors the initialization of the DFS Replication debug log and creates a Warning alert if it detects that DFS Replication was unable to initialize the log.

Knowledge Base article:

Summary

This object monitors the initialization of the DFS Replication debug log and creates a Critical alert if it detects that DFS Replication was unable to initialize the log. It does so by looking for the presence of DFS Replication Event 1312.

Causes

An unhealthy state of this monitor indicates that debug logging is disabled because DFS Replication was unable to initialize debug logging. This usually occurs when DFS Replication cannot access the path of the debug log folder. This can occur for the following reasons:

The volume hosting the debug log folder is offline or on a network share.
The volume hosting the debug log folder is out of disk space.
The debug log folder has exceeded a quota set on the folder or volume hosting the folder.
Incorrect permissions are set on the debug log folder.

Resolutions

Locate the debug log files

To find the path configured for debug logs, type the following command on the affected computer:

wmic /namespace:\\root\microsoftdfs path DfsrMachineConfig get DebugLogFilePath

Verify that the path exists and that it is local to the affected computer. It must not be a UNC address or network path.

If the path does not exist, you can either create the path or change the default debug log location. To change the debug log location, type the following command, where [new_target_path] is the new path for the debug logs:]

wmic /namespace:\\root\microsoftdfs path DfsrMachineConfig set DebugLogFilePath=[new_target_path]

Increase available disk space

If the volume hosting the staging folder or debug log files is low on disk space, increase the available disk space on the volume, increase the size of the volume, or change the path of the staging folder to a volume with more available disk space.

To manually check the amount of available disk space, open a command prompt window and type the following command, where [servername] is the name of the server hosting the affected folder and [domain\user] is your user name:

WMIC /node: "[servername]" /user: [domain\user] volume list status.

After freeing up space, restart the DFS Replication service.

Adjust quotas

If a quota (NTFS disk quota or File Server Resource Manager quota) is limiting the affected folder or volume, consider increasing the quota size.

To adjust folders created with File Server Resource Manager, see Quota Management (http://go.microsoft.com/fwlink/?LinkId=187098).
To adjust NTFS disk quotas, use the Fsutil quota command, as discussed in FSutil quota (http://go.microsoft.com/fwlink/?LinkId=187104).

Correct the debug log folder permissions

If the DFS Replication service doesn’t have Full Control permissions to the debug log folder, logging will fail. To resolve this issue, grant the local System account Full Controlpermissions to the debug log folder.

Verification

This monitor automatically resets to a healthy state when the issue is resolved.

Additional

DFS Replication Event 1312(http://go.microsoft.com/fwlink/?LinkId=187120)

Element properties:

Target

Microsoft.Windows.FileServer.DFSR.Service

Parent Monitor

Microsoft.Windows.FileServer.DFSR.LoggingAggregateMonitor

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

DFS-R: Failed to Initialize Debug Logging

{0}

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.Windows.FileServer.DFSR.DebugLogInitFailedMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.FileServer.DFSR.Service" ParentMonitorID="Microsoft.Windows.FileServer.DFSR.LoggingAggregateMonitor" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.FileServer.DFSR.DebugLogInitFailedMonitor_AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="FirstEventRaised" MonitorTypeStateID="FirstEventRaised" HealthState="Warning"/>

    <OperationalState ID="SecondEventRaised" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>DFS Replication</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">1312</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">DFSR</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>DFS Replication</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">DFSR</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1314</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1004</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>